{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Set working directory"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Python 3.8.2\r\n"
     ]
    }
   ],
   "source": [
    "import os\n",
    "cwd = os.path.split(os.getcwd())\n",
    "if cwd[-1] == 'tutorials':\n",
    "    os.chdir('..')\n",
    "# TODO assert in the correct directory\n",
    "!python --version"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Import modules"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "from BRON.build_BRON import build_graph\n",
    "from path_search.path_search_BRON import main_attack\n",
    "from utils.bron_network_utils import load_graph_nodes\n",
    "from utils.tutorial_util import print_files_in_folder"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Build BRON"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The different types of threat data are linked together in a graph called BRON. The data types are linked with bidirectional edges in the following manner:\n",
    "```\n",
    "Tactic <--> Technique <--> CAPEC <--> CWE <--> CVE <--> CPE\n",
    "```\n",
    "To create a new BRON using input threat data, run the following command:\n",
    "```\n",
    "python BRON/build_BRON.py --input_data_folder INPUT_DATA_FOLDER --save_path SAVE_PATH --only_recent_cves (optional)\n",
    "``` \n",
    "`INPUT_DATA_FOLDER` is the folder path to input threat data, and `SAVE_PATH` is the folder path to save the BRON graph and files. The `SAVE_PATH` folder should contain subfolders organized as follows: `SAVE_PATH/BRON/original_id_to_bron_id`. To make BRON using only recent CVEs, add the argument `--only_recent_cves`. An example BRON with its input threat data can be found in the `example_data` folder."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "save_path = 'example_data/example_output_data'\n",
    "input_data_folder = 'example_data/example_input_data'\n",
    "build_graph(save_path, input_data_folder)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "'example_data/example_output_data/BRON 1598530105.965684'\n",
      "'example_data/example_output_data/all_cves_all_versions 1598530105.9690936'\n",
      "'example_data/example_output_data/all_cves_latest_version 1598530105.9699273'\n",
      "('example_data/example_output_data/search_result_ibm_business_process_manager.csv '\n",
      " '1598530105.9832911')\n",
      "'example_data/example_output_data/figures 1601316149.9301994'\n",
      "'example_data/example_output_data/search_result_tactic.csv 1601389591.769105'\n",
      "'example_data/example_output_data/search_result_technique.csv 1601389591.869807'\n",
      "'example_data/example_output_data/BRON.json 1601396716.0232089'\n"
     ]
    }
   ],
   "source": [
    "print_files_in_folder(save_path)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Structure of BRON"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Each entry of threat data is a node in BRON that has 4 attributes. The node has a unique name in BRON of the form (threat data type)\\_(unique 5 digit id) where the threat data type is either Tactic, Technique, CAPEC, CWE, CVE, or CPE.\n",
    "\n",
    "There are 4 attributes for each node:\n",
    "- Original_id: ID of threat data in MITRE/NIST if it exists\n",
    "- Datatype: One of Tactic, Technique, CAPEC, CWE, CVE, or CPE\n",
    "- Name: Name of threat data in MITRE/NIST if it exists\n",
    "- Metadata: Any additional information that is contained in MITRE/NIST "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Find paths in BRON"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Once BRON is built, it can be searched for paths that contain certain data types or specific nodes. The path search starts with a set of starting points and then finds all paths in BRON from those starting points. A severity score based on the CVSS score is calculated for each path that is found. To find paths in BRON, run the following command:\n",
    "```\n",
    "python -m path_search.path_search_BRON --BRON_folder_path BRON_FOLDER_PATH --starting_point STARTING_POINT --starting_point_type STARTING_POINT_TYPE --results_file RESULTS_FILE --length (optional)\n",
    "```\n",
    "`BRON_FOLDER_PATH` is the folder path to the BRON graph that is being searched, `STARTING_POINT` is the file path to the CSV file that contains the starting point IDs, `STARTING_POINT_TYPE` is the data type of the starting points (either Tactic, Technique, CAPEC, CWE, CVE, or CPE), and `RESULTS_FILE` is the file path to store the CSV results file.\n",
    "\n",
    "To make the results contain only the _number_ of nodes in a path instead of a set of node names, add the argument `--length`.\n",
    "\n",
    "The output of path search is a CSV file that shows how the different data types are related to each other. The paths start at the type of argument and then search the graph to find the connections to other data. For example, if the input file consisted of 3 CAPECs: 100, 105, 200, then we would see all of the Tactics, Techniques, CWEs, CVEs, and CPEs associated with each CAPEC individually. The final row contains the total count of each data type in BRON. An example starting point file and its path search result can be found in the `example_data` folder."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique</th>\n",
       "      <th>capec</th>\n",
       "      <th>cwe</th>\n",
       "      <th>cve</th>\n",
       "      <th>risk_score</th>\n",
       "      <th>cpe</th>\n",
       "      <th>attack</th>\n",
       "      <th>Node Type</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>{tactic_00008}</td>\n",
       "      <td>{technique_00077, technique_00175, technique_0...</td>\n",
       "      <td>{capec_00308, capec_00301, capec_00311, capec_...</td>\n",
       "      <td>{cwe_00347, cwe_00519, cwe_00546, cwe_00522, c...</td>\n",
       "      <td>{cve_01536, cve_01045, cve_01459, cve_01167}</td>\n",
       "      <td>25.70</td>\n",
       "      <td>{cpe_01044, cpe_01168, cpe_01533, cpe_01458}</td>\n",
       "      <td>NaN</td>\n",
       "      <td>connected</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>{tactic_00014}</td>\n",
       "      <td>{technique_00027, technique_00098, technique_0...</td>\n",
       "      <td>{capec_00325, capec_00283, capec_00339, capec_...</td>\n",
       "      <td>{cwe_00914, cwe_00412, cwe_00502, cwe_00346}</td>\n",
       "      <td>{cve_01448, cve_01449, cve_01047, cve_01144, c...</td>\n",
       "      <td>101.50</td>\n",
       "      <td>{cpe_01444, cpe_01101, cpe_01251, cpe_01249, c...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>connected</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>{tactic_00012}</td>\n",
       "      <td>{technique_00016, technique_00127, technique_0...</td>\n",
       "      <td>{capec_00308, capec_00301, capec_00289, capec_...</td>\n",
       "      <td>{cwe_00357, cwe_00420, cwe_00422, cwe_00653, c...</td>\n",
       "      <td>{cve_01518, cve_01496, cve_01169, cve_01254, c...</td>\n",
       "      <td>101.95</td>\n",
       "      <td>{cpe_01407, cpe_01410, cpe_01391, cpe_01286, c...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>connected</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>12</td>\n",
       "      <td>266</td>\n",
       "      <td>519</td>\n",
       "      <td>251</td>\n",
       "      <td>217</td>\n",
       "      <td>1014.00</td>\n",
       "      <td>277</td>\n",
       "      <td>0.0</td>\n",
       "      <td>Total Number</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "           tactic                                          technique  \\\n",
       "0  {tactic_00008}  {technique_00077, technique_00175, technique_0...   \n",
       "1  {tactic_00014}  {technique_00027, technique_00098, technique_0...   \n",
       "2  {tactic_00012}  {technique_00016, technique_00127, technique_0...   \n",
       "3              12                                                266   \n",
       "\n",
       "                                               capec  \\\n",
       "0  {capec_00308, capec_00301, capec_00311, capec_...   \n",
       "1  {capec_00325, capec_00283, capec_00339, capec_...   \n",
       "2  {capec_00308, capec_00301, capec_00289, capec_...   \n",
       "3                                                519   \n",
       "\n",
       "                                                 cwe  \\\n",
       "0  {cwe_00347, cwe_00519, cwe_00546, cwe_00522, c...   \n",
       "1       {cwe_00914, cwe_00412, cwe_00502, cwe_00346}   \n",
       "2  {cwe_00357, cwe_00420, cwe_00422, cwe_00653, c...   \n",
       "3                                                251   \n",
       "\n",
       "                                                 cve  risk_score  \\\n",
       "0       {cve_01536, cve_01045, cve_01459, cve_01167}       25.70   \n",
       "1  {cve_01448, cve_01449, cve_01047, cve_01144, c...      101.50   \n",
       "2  {cve_01518, cve_01496, cve_01169, cve_01254, c...      101.95   \n",
       "3                                                217     1014.00   \n",
       "\n",
       "                                                 cpe  attack     Node Type  \n",
       "0       {cpe_01044, cpe_01168, cpe_01533, cpe_01458}     NaN     connected  \n",
       "1  {cpe_01444, cpe_01101, cpe_01251, cpe_01249, c...     NaN     connected  \n",
       "2  {cpe_01407, cpe_01410, cpe_01391, cpe_01286, c...     NaN     connected  \n",
       "3                                                277     0.0  Total Number  "
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "starting_point_type = 'tactic'\n",
    "starting_point = os.path.join(input_data_folder, f'starting_point_{starting_point_type}.csv')\n",
    "results_file = os.path.join(save_path, f'search_result_{starting_point_type}.csv')\n",
    "length = False\n",
    "main_attack(BRON_folder_path=save_path,\n",
    "            args_file=starting_point,\n",
    "            results_name=results_file,\n",
    "            arg_type=starting_point_type,\n",
    "            length=length)\n",
    "# TODO change risk_score to cvss_score (a better name)\n",
    "# TODO print also the actual (not only bron ID)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique</th>\n",
       "      <th>capec</th>\n",
       "      <th>cwe</th>\n",
       "      <th>cve</th>\n",
       "      <th>risk_score</th>\n",
       "      <th>cpe</th>\n",
       "      <th>attack</th>\n",
       "      <th>Node Type</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>{tactic_00004}</td>\n",
       "      <td>{technique_00003}</td>\n",
       "      <td>{}</td>\n",
       "      <td>{}</td>\n",
       "      <td>{}</td>\n",
       "      <td>0.0</td>\n",
       "      <td>{}</td>\n",
       "      <td>NaN</td>\n",
       "      <td>connected</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>12</td>\n",
       "      <td>266</td>\n",
       "      <td>519</td>\n",
       "      <td>251</td>\n",
       "      <td>217</td>\n",
       "      <td>1014.0</td>\n",
       "      <td>277</td>\n",
       "      <td>0.0</td>\n",
       "      <td>Total Number</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "           tactic          technique capec  cwe  cve  risk_score  cpe  attack  \\\n",
       "0  {tactic_00004}  {technique_00003}    {}   {}   {}         0.0   {}     NaN   \n",
       "1              12                266   519  251  217      1014.0  277     0.0   \n",
       "\n",
       "      Node Type  \n",
       "0     connected  \n",
       "1  Total Number  "
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "starting_point_type = 'technique'\n",
    "starting_point = os.path.join(input_data_folder, f'starting_point_{starting_point_type}.csv')\n",
    "results_file = os.path.join(save_path, f'search_result_{starting_point_type}.csv')\n",
    "length = False\n",
    "main_attack(BRON_folder_path=save_path,\n",
    "            args_file=starting_point,\n",
    "            results_name=results_file,\n",
    "            arg_type=starting_point_type,\n",
    "            length=length)"
   ]
  }
 ],
 "metadata": {
  "@webio": {
   "lastCommId": null,
   "lastKernelId": null
  },
  "kernelspec": {
   "display_name": "venv_BRON",
   "language": "python",
   "name": "venv_bron"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.2"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}
